adding required fields

detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml

@@ -16,7 +16,7 @@ description: The following analytic identifies one source endpoint failing to au
   This detection will trigger on the domain controller against which the offending host performs the password spraying attack.
 
   The analytic's returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.
-search: ' `wineventlog_security` EventCode=4768 Result_Code=0x12 | stats  dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by Client_Address  | where  unique_accounts > 10'
+search: ' `wineventlog_security` EventCode=4768 Result_Code=0x12 | stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by Client_Address  | where  unique_accounts > 10'
 how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting 
 'Audit Kerberos Authentication Service' within 'Account Logon' needs to be enabled.
 known_false_positives: A host failing to authenticate with multiple disabled domain users is not a common behavior for legitimate systems. Possible false positive scenarios 
@@ -35,4 +35,8 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - EventCode
+  - Result_Code
+  - Account_Name
+  - Client_Address
   security_domain: endpoint

detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos_.yml

@@ -35,4 +35,8 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - EventCode
+  - Result_Code
+  - Account_Name
+  - Client_Address
   security_domain: endpoint

detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml

@@ -39,4 +39,8 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - EventCode
+  - action
+  - Logon_Account
+  - Source_Workstation
   security_domain: endpoint

detections/endpoint/multiple_users_failing_to_authenticae_from_host_using_ntlm.ym

@@ -39,4 +39,8 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - EventCode
+  - action
+  - Logon_Account
+  - Source_Workstation
   security_domain: endpoint

detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml

@@ -37,5 +37,9 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
+   - _time
+  - EventCode
+  - Result_Code
+  - Account_Name
+  - Client_Address
   security_domain: endpoint

detections/endpoint/multiple_users_failing_to_authenticate_from_one_process.yml

@@ -17,7 +17,7 @@ description: The following analytic identifies a source process name failing to
 
  The analytic's returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts.
 
-search: ' `wineventlog_security` EventCode=4625 Logon_Type=2  Caller_Process_Name!="-" | eval Source_Account = mvindex(Security_ID, 0) | eval Destination_Account = mvindex(Account_Name, 1)  | stats  dc(Destination_Account) AS unique_accounts values(Account_Name) as tried_accounts by Caller_Process_Name, Source_Account, ComputerName  | where  unique_accounts > 10'
+search: ' `wineventlog_security` EventCode=4625 Logon_Type=2  !="-" | eval Source_Account = mvindex(Security_ID, 0) | eval Destination_Account = mvindex(Account_Name, 1)  | stats  dc(Destination_Account) AS unique_accounts values(Account_Name) as tried_accounts by Caller_Process_Name, Source_Account, ComputerName  | where  unique_accounts > 10'
 how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers aas 
 well as member servers and workstations. The Advanced Security Audit policy setting 'Audit Logon' within 'Logon/Logoff' needs to be enabled.
 known_false_positives: A process failing to authenticate with multiple users is not a common behavior for legitimate user sessions. Possible false positive scenarios 
@@ -40,4 +40,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - EventCode
+  - Logon_Type
+  - Caller_Process_Name
+  - Security_ID
+  - Account_Name
+  - ComputerName
   security_domain: endpoint

detections/endpoint/multiple_users_failing_to_authenticate_using_explicit_credentials.yml

@@ -39,4 +39,8 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - EventCode
+  - Security_ID
+  - Account_Name
+  - ComputerName
   security_domain: endpoint

detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml

@@ -38,5 +38,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
+   - _time
+  - EventCode
+  - Logon_Type
+  - Security_ID
+  - Account_Name
+  - ComputerName
+  - Source_Network_Address
   security_domain: endpoint